CVE IDCVE-2024-34447GitHub advisory IDGHSA-4h8f-2wvx-gg5w
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning
CVE-2024-34447 (GitHub advisory GHSA-4h8f-2wvx-gg5w) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.9, classed as Improper Validation of Certificate with Host Mismatch (CWE-297), in 7 packages, including org.bouncycastle:bcprov-jdk18on (Maven) and org.bouncycastle:bcprov-jdk15to18 (Maven). Fixed versions: org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; and 5 more packages.
Medium5.9Fix availableGitHub reviewed
Published 3 May 2024Updated 17 Apr 2026
- CVE ID
- CVE-2024-34447
- GHSA ID
- GHSA-4h8f-2wvx-gg5w
- EPSS
- 0.77%higher than 53% of CVEs
- Weakness (CWE)
- CWE-297Improper Validation of Certificate with Host Mismatch
- KEV status
- Not in KEV
- Published
- 3 May 2024
- Updated
- 17 Apr 2026
- Ecosystem
- Maven
- Assigned by (CNA)
- mitre
Summary
Source: OSV (GitHub advisory)
An issue was discovered in the Bouncy Castle Crypto Package For Java before BC TLS Java 1.0.19 (ships with BC Java 1.78, BC Java (LTS) 2.73.6) and before BC FIPS TLS Java 1.0.19. When endpoint identification is enabled in the BCJSSE and an SSL socket is created without an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address in some situations, opening up a possibility of DNS poisoning.
Technical details
Source: GitHub Advisory Database
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NMedium5.9Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- High
- Privileges Required PR
- None
- User Interaction UI
- None
- Scope S
- Unchanged
- Confidentiality C
- None
- Integrity I
- High
- Availability A
- None
CISA SSVC decision points
- Exploitation
- none
- No public exploitation evidence
- Automatable
- no
- Needs manual steps per target
- Technical impact
- partial
- Limited control of the affected system
CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.
Affected packages
Source: OSV (GitHub advisory)
- org.bouncycastle:bcprov-jdk18onMaven
pkg:maven/org.bouncycastle/bcprov-jdk18on- Affected versions
- >= 1.61, < 1.78
- Fixed in
- 1.78
Show 8 listed versions
- 1.71
- 1.71.1
- 1.72
- 1.73
- 1.74
- 1.75
- 1.76
- 1.77
- org.bouncycastle:bcprov-jdk15to18Maven
pkg:maven/org.bouncycastle/bcprov-jdk15to18- Affected versions
- >= 1.61, < 1.78
- Fixed in
- 1.78
Show 15 listed versions
- 1.63
- 1.64
- 1.65
- 1.66
- 1.67
- 1.68
- 1.69
- 1.70
- 1.71
- 1.72
- 1.73
- 1.74
- org.bouncycastle:bcprov-jdk14Maven
pkg:maven/org.bouncycastle/bcprov-jdk14- Affected versions
- >= 1.61, < 1.78
- Fixed in
- 1.78
Show 16 listed versions
- 1.61
- 1.62
- 1.63
- 1.64
- 1.65
- 1.67
- 1.68
- 1.69
- 1.70
- 1.71
- 1.72
- 1.73
- org.bouncycastle:bcprov-jdk12Maven
pkg:maven/org.bouncycastle/bcprov-jdk12- Affected versions
- >= 1.61, < 1.78
- Fixed in
- 1.78
- org.bouncycastle:bctls-fipsMaven
pkg:maven/org.bouncycastle/bctls-fips- Affected versions
- < 1.0.19
- Fixed in
- 1.0.19
Show 29 listed versions
- 1.0.0
- 1.0.1
- 1.0.10
- 1.0.10.1
- 1.0.10.2
- 1.0.10.3
- 1.0.11
- 1.0.11.1
- 1.0.11.2
- 1.0.11.3
- 1.0.11.4
- 1.0.12
- org.bouncycastle:bcprov-lts8onMaven
pkg:maven/org.bouncycastle/bcprov-lts8on- Affected versions
- < 2.73.6
- Fixed in
- 2.73.6
Show 6 listed versions
- 2.73.0
- 2.73.1
- 2.73.2
- 2.73.3
- 2.73.4
- 2.73.5
- org.bouncycastle:bcprov-jdk15onMaven
pkg:maven/org.bouncycastle/bcprov-jdk15on- Affected versions
- >= 1.61, < 1.78
- Fixed in
- 1.78
Show 11 listed versions
- 1.61
- 1.62
- 1.63
- 1.64
- 1.65
- 1.65.01
- 1.66
- 1.67
- 1.68
- 1.69
- 1.70
| Package | Affected versions | Fixed in |
|---|---|---|
org.bouncycastle:bcprov-jdk18on Maven pkg:maven/org.bouncycastle/bcprov-jdk18on |
Show 8 listed versions
|
|
org.bouncycastle:bcprov-jdk15to18 Maven pkg:maven/org.bouncycastle/bcprov-jdk15to18 |
Show 15 listed versions
|
|
org.bouncycastle:bcprov-jdk14 Maven pkg:maven/org.bouncycastle/bcprov-jdk14 |
Show 16 listed versions
|
|
org.bouncycastle:bcprov-jdk12 Maven pkg:maven/org.bouncycastle/bcprov-jdk12 |
|
|
org.bouncycastle:bctls-fips Maven pkg:maven/org.bouncycastle/bctls-fips |
Show 29 listed versions
|
|
org.bouncycastle:bcprov-lts8on Maven pkg:maven/org.bouncycastle/bcprov-lts8on |
Show 6 listed versions
|
|
org.bouncycastle:bcprov-jdk15on Maven pkg:maven/org.bouncycastle/bcprov-jdk15on |
Show 11 listed versions
|
|
Fix
Source: OSV (GitHub advisory)
Fix available
- org.bouncycastle:bcprov-jdk18on: upgrade to
1.78or later - org.bouncycastle:bcprov-jdk15to18: upgrade to
1.78or later - org.bouncycastle:bcprov-jdk14: upgrade to
1.78or later - org.bouncycastle:bcprov-jdk12: upgrade to
1.78or later - org.bouncycastle:bctls-fips: upgrade to
1.0.19or later - org.bouncycastle:bcprov-lts8on: upgrade to
2.73.6or later - org.bouncycastle:bcprov-jdk15on: upgrade to
1.78or later
Vulnerability intelligence
Root cause analysis
Not published for this vulnerability yetWhere the bug lives in the code, why it's exploitable, and what the patch changed.Request this analysis
Vulnerable functions
Not published for this vulnerability yetThe exact functions and files on the vulnerable code path, so you can check whether you call them.Request this analysis
References
Advisories 3
Reports and issues 1
Package 1
Credits
- samuelophanalyst
- binary-1024analyst
- hmolsenanalyst
- kmoensanalyst
Questions about CVE-2024-34447
- What is the GHSA ID for CVE-2024-34447?
- GitHub tracks CVE-2024-34447 as GHSA-4h8f-2wvx-gg5w.
- What is the CVSS score of CVE-2024-34447?
- CVE-2024-34447 has a CVSS 3.1 base score of 5.9 (Medium), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. Other published scores: CVSS 3.1 7.5.
- Which versions are affected by CVE-2024-34447?
- org.bouncycastle:bcprov-jdk18on (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk15to18 (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk14 (Maven): >= 1.61, < 1.78. org.bouncycastle:bcprov-jdk12 (Maven): >= 1.61, < 1.78. org.bouncycastle:bctls-fips (Maven): < 1.0.19. org.bouncycastle:bcprov-lts8on (Maven): < 2.73.6. 1 more packages are listed on the page.
- How do I fix CVE-2024-34447?
- Upgrade each package to its fixed version: org.bouncycastle:bcprov-jdk18on 1.78; org.bouncycastle:bcprov-jdk15to18 1.78; org.bouncycastle:bcprov-jdk14 1.78; org.bouncycastle:bcprov-jdk12 1.78; and 3 more packages.
- What is the Package URL (PURL) for CVE-2024-34447?
- The affected packages' PURLs are pkg:maven/org.bouncycastle/bcprov-jdk18on, pkg:maven/org.bouncycastle/bcprov-jdk15to18, pkg:maven/org.bouncycastle/bcprov-jdk14, pkg:maven/org.bouncycastle/bcprov-jdk12, pkg:maven/org.bouncycastle/bctls-fips and pkg:maven/org.bouncycastle/bcprov-lts8on and more.
- Is CVE-2024-34447 exploited in the wild?
- CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-34447. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 53% of CVEs.
Data sources
Upstream records
- OSV (GitHub advisory)LoadedRaw JSON
- GitHub Advisory DatabaseLoadedRaw JSON
- OSV (CVE record)LoadedRaw JSON
- CVE.orgLoaded
- CISA KEV catalogLoaded
Fetched 4 days ago (9 Oct 2026, 19:41 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- OSV (GitHub advisory)
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- OSV (GitHub advisory)
- Fix
- OSV (GitHub advisory)
- References
- Computed by CVEminer
- SSVC
- CVE.org
- KEV status
- CISA KEV catalog
- EPSS
- GitHub Advisory Database
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.